Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Callback phishing phone lure medium SE_CALLBACK_LURE
  Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
• Urgency / deadline lure low SE_URGENCY_LURE
  Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://seumenha.ru/strik?utm_term=jazzy+select+6+total+weight PDF link annotation

  • https://jilolepileg.weebly.com/uploads/1/3/1/4/131453494/dopufiredikalifaxub.pdfIn PDF document text
  • https://fobinoxibenor.weebly.com/uploads/1/3/1/4/131437242/5114c.pdfIn PDF document text
  • https://cdn.sqhk.co/xamitarerivu/cyiakij/hierarchy_template_ppt_free.pdfIn PDF document text
  • https://cdn.sqhk.co/jekunesoru/KBhi431/jizajawafov.pdfIn PDF document text
  • https://juwibaviwexufeb.weebly.com/uploads/1/3/0/7/130739975/5741308.pdfIn PDF document text
  • http://povisowalikim.scienceontheweb.net/o_significado_dos_versculos_do_alcoro_sagrado.pdfIn PDF document text
  • http://patajafurep.mywebcommunity.org/arbeitsvertrag_kndigen.pdfIn PDF document text
  • https://tekoboxini.weebly.com/uploads/1/3/0/8/130814877/599bf576d34dbfe.pdfIn PDF document text
  • http://xejitifuwoligaf.mypressonline.com/sony_a6500_price_in_india_flipkart.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://52c77544-2eb8-427c-ad0e-a8a7e2ea9366.filesusr.com/ugd/93288f_1e19225720fe48a88d439ca62e7be5da.pdf?index=trueIn PDF document text
  • http://rixibebesimi.epizy.com/thermo_king_md_200_parts_diagram.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/130d3d84-649a-4751-80a8-5307637a64fc/tropic_of_cancer_degrees_latitude.pdfIn PDF document text
  • http://pomolado.epizy.com/how_to_teach_conversational_english_online.pdfIn PDF document text
  • https://8d275f60-8e36-4e70-8574-b6d542a617c4.filesusr.com/ugd/dbf6c2_80f53bce340b4defaf1189b54cc0c837.pdf?index=trueIn PDF document text
  • http://gudanomakorake.epizy.com/49799861790.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/44ae40dc-7b9a-4065-8fe8-06be9b2f6553/75819496537.pdfIn PDF document text
  • https://83f018a0-8e49-44f0-b57e-805e464a5f06.filesusr.com/ugd/10a4aa_6fb26420037c4190b9fcaac88dd39107.pdf?index=trueIn PDF document text
  • https://58eafb2e-ea74-4523-a1b2-d2e0fe9bfe54.filesusr.com/ugd/466fa0_68d3b46092c64cbbbdadfbb04c16d30a.pdf?index=trueIn PDF document text
  • http://lunupoxupa.rf.gd/information_technology_manager_education_requirements.pdfIn PDF document text
  • https://5c3e38fa-bf2d-4cda-bfdc-19e9a39f2227.filesusr.com/ugd/b3ada4_b8bd9f1faf3841e991acb2dffc353407.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/74a3796f-a79d-4aac-828d-12b5c07d539c/lg_steam_washer_error_code_03.pdfIn PDF document text
  • http://piwolimosopobu.myartsonline.com/familia_enterobacterias.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/52715a31-a7e9-49f6-9ad7-d408674e5ea4/23692843445.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.